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Dear Ms. Kendall: 


We have reviewed the system of quality control for the audit organization of the 
Department of the Interior (DOI) Office of Inspector General (OIG) in effect for the year 
ended September 30, 2010. A system of quality control encompasses the DOI OIG’s 
organizational structure and the policies adopted and procedures established to provide it 
with reasonable assurance of conforming with Government Auditing Standards. The 
elements of quality control are described in Government Auditing Standards. The DOI 
OIG is responsible for designing a system of quality control and complying with it to 
provide the DOI OIG with reasonable assurance of performing and reporting in 
conformity with applicable professional standards in all material respects. Our 
responsibility is to express an opinion on the design of the system of quality control and 
the DOI OIG’s compliance therewith based on our review. 


Our review was conducted in accordance with Government Auditing Standards and 
guidelines established by the Council of the Inspectors General on Integrity and 
Efficiency (CIGIE). During our review, we interviewed DOI OIG personnel and 
obtained an understanding of the nature of the DOI OIG audit organization, and the 
design of the DOI OIG’s system of quality control sufficient to assess the risks implicit in 
its audit function. Based on our assessments, we selected engagements and 
administrative files to test for conformity with professional standards and compliance 
with the DOI OIG’s system of quality control. The engagements selected represented a 
reasonable cross-section of the DOI OIG’s audit organization, with emphasis on higher- 
risk engagements. Prior to concluding the review, we reassessed the adequacy of the 
scope of the peer review procedures and met with DOI OIG management to discuss the 
results of our review. We believe that the procedures we performed provide a reasonable 
basis for our opinion. 
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In performing our review, we obtained an understanding of the system of quality control 
for the DOI OIG’s audit organization. In addition, we tested compliance with the DOI 
OIG’s quality control policies and procedures to the extent we considered appropriate. 
These tests covered the application of the DOI OIG’s policies and procedures on selected 
engagements. Our review was based on selected tests; therefore, it would not necessarily 
detect all weaknesses in the system of quality control or all instances of noncompliance 
with it. 


There are inherent limitations in the effectiveness of any system of quality control, and 
therefore noncompliance with the system of quality control may occur and not be 
detected. Projection of any evaluation of a system of quality control to future periods is 
subject to the risk that the system of quality control may become inadequate because of 
changes in conditions, or because the degree of compliance with the policies or 
procedures may deteriorate. 


In addition to reviewing its system of quality control to ensure adherence with 
Government Auditing Standards, we applied certain limited procedures in accordance 
with guidance established by the CIGIE related to the DOI OIG’s monitoring of 
engagements performed by Independent Public Accountants (IPA) under contract where 
the IPA served as the principal auditor. It should be noted that monitoring of 
engagements performed by IPAs is not an audit and therefore is not subject to the 
requirements of Government Auditing Standards. The purpose of our limited procedures 
was to determine whether the DOI OIG had controls to ensure IPAs performed contracted 
work in accordance with professional standards. However, our objective was not to 
express an opinion and accordingly, we do not express an opinion, on the DOI OIG’s 
monitoring of work performed by IPAs. 


In our opinion, the system of quality control for the audit organization of DOI OIG in 
effect for the year ended September 30, 2010, has been suitably designed and complied 
with to provide the DOI OIG with reasonable assurance of performing and reporting in 
conformity with applicable professional standards in all material respects. Federal audit 
organizations can receive a rating of pass, pass with deficiencies, or fail. The DOI OIG 
has received a peer review rating of pass. 


We noted, however, conditions that warrant your attention, though they did not impact 
our opinion. These matters are described in more detail in Enclosure 1 to this report, 
under findings and recommendations. 


Enclosure 2 to this report identifies the offices of the DOI OIG that we visited and the 
engagements that we reviewed. 


The DOI OIG Assistant Inspector General for Audits, Inspections, and Evaluations 
concurred with our findings and recommendations in a July 22, 2011 response to our draft 
report. The DOI OIG plans to take action to address our findings and revise its policies 
and quality assurance review process to emphasize the conditions noted in our report. 
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The Office of Audits, Inspections, and Evaluations plans to have its new policies issued 
and the new quality assurance process in place by September 30, 2011. The Assistant 
Inspector General for Audits, Inspections, and Evaluations’ response is included as 
Exhibit A. 


I would like to express my sincere appreciation for the cooperation and consideration 
extended to my staff. If you have any questions, please contact me or Michael R. Esser, 
Assistant Inspector General for Audits, at 202-606-1200. 


Sincerely, 


Patrick E. McFarland 
Inspector General 


Enclosure 
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FINDINGS AND RECOMMENDATIONS 
Audit Risk Assessment 


We found that the audit risk assessment procedures need to be re-emphasized to the audit 
staff. The audit documentation for 5 of the 10 audits that we reviewed contained no audit 
risk assessment. The five reports are: 


"= C-IN-MMS-0007-2008 — Mineral Management Service: Royalty-in-Kind Program’s 
Oil Volume Verification Process 


= C-IN-MOA-0010-2008 — DOI’s Accountability and Preservation of Museum 
Collections 


" VI-EV-VIS-0003-2009 — Monitoring of Capital Improvements Projects — Virgin 
Islands; Port Authority 


= K-CX-NPS-0006-2009 — Westwind Contracting, Inc. Settlement Proposal 
"= ER-IN-OSS-0009-2009 — International Technical Assistance Program 


Audit risk is the possibility that the auditors' findings, conclusions, recommendations, or 
assurance may be improper or incomplete, as a result of factors such as insufficient or 
inappropriate evidence, an inadequate audit process or intentionally omitted or 
misleading information. Government Auditing Standards require auditors to plan the 
audit to reduce audit risk to an appropriate level. Government Auditing Standards also 
require auditors to assess audit risk by gaining an understanding of internal control as it 
relates to the specific objectives and scope of the audit. In addition, the DOI OIG Audit 
Memorandum No. 05-OA-2008, Audit Risk, states: "During audit planning, the audit 
team must assess audit risk...” The Audit Memorandum establishes policy and provides 
detailed procedures for assessing audit risk. 


Recommendation 1 
We recommend that the DOI OIG management ensure that during the planning 


stage, audit teams complete and document an audit risk assessment for all 
Government Auditing Standards audits. 


Views of Responsible Office: Agree 
Sampling Methodology 


We found that the DOI OIG audit reports and the corresponding working papers did not 
always include an adequate description of the sampling methodology used in conducting 
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the audits. Two of the 10 audits that we reviewed did not contain a sampling 
methodology. The two reports are: 


"= C-IN-MMS-0007-2008 — Mineral Management Service: Royalty-in-Kind a S 
Oil Volume Verification Process 


# VI-EV-VIS-0003-2009 — Monitoring of Capital Improvements Projects — Virgin 
Islands; Port Authority 


Government Auditing Standards state that when the sampling methodology supports the 
auditors’ findings, conclusions or recommendations, the auditors should describe the 
sampling design and state why the design or plan was chosen, including whether the 
results can be projected to the intended population. Without an adequate description of 
the sampling methodology, reviewers and readers may not understand the work 
conducted and the significance of the findings. We could not find any DOI OIG policies 
or procedures explaining the methodology of sampling or the requirement to include a 
description of the methodology in audit reports. 


Report No. C-IN-MMS-0007-2008 states that to accomplish the objectives, samples of 
sales proprieties were selected. However, no description of the sampling methodology is 
mentioned in the audit report. In addition, Strategic Petroleum Reserve sampling and 
testing was performed and referred to in the working papers; however, the sampling 
methodology was not mentioned in the report. 


Report No. VI-EV-VIS-0003-2009 states that 12 projects were selected for sampling. 
Within another part of the report, we found that the total number of projects was 109. 
There was no sampling methodology mentioned in the audit report or working papers. In 
addition, the referencer’s comment sheet requested an explanation and justification for 
the sample selected. The comment given was that it was randomly sampled. However, 
this is not shown in the working papers. 


None of the reports or working papers stated whether the sample results could be 
projected to the population. 


Recommendation 2 


We recommend that the DOI OIG management: 1) ensure that a sampling 
methodology is described in the audit report and working papers for any audit that 
uses sampling; and, 2) issue a memorandum providing guidance for all of the 
audit offices to include a description of the sampling methodology in their audit 
reports and working papers. 


Views of Responsible Office: Agree 
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Report Timeliness 


We found that the DOI OIG did not comply with Government Auditing Standards and its 
own audit policy and procedures regarding timeliness. Four of the 10 audits reviewed 
were not issued in a timely manner. Those reports are: 


Report Number Number of Months over the 1 Year Period 
"= C-IN-MMS-0007-2008 11 months 
a" VI-EV-VIS-0003-2009 6 months 
= C-IN-MOA-0010-2008 4 months 
" ER-IN-OSS-0009-2009 3 months 


Government Auditing Standards state to be of maximum use, providing relevant evidence 
in time to respond to officials of the audited entity, legislative officials, and other users' 
legitimate needs is the auditors’ goal. Likewise, the evidence provided in the report is 
more helpful if it is current. Therefore, the timely issuance of the report is an important 
reporting goal for auditors. 


DOI OIG Audit Memorandum No. 04-OA-2005, Audit Timeliness and Milestones, states 
that the timely issuance of audit reports is a key factor in their usefulness to Departmental 
managers. Significant delays increase the risk that the audit information is outdated or 
not meaningful to current conditions. 


The Audit Memorandum further states that the OIG policy for the maximum elapsed days 
from start of the review (audit or evaluation) to issuance of the final report is 1 year. The 
1-year timeframe pertains to complex internal audits and evaluations. Smaller scale 
evaluations, audits of contracts and grants, and other limited scope reviews should be 
completed within shorter periods. 


Also, the Audit Memorandum states that the timeline for issuing final reports within 1 
year of the start date begins with the date of the entrance conference and ends with the 
issuance of the final audit report. The audit team should present options to complete the 
review within 1 year if delays are expected. Some of these options include adding 
additional staff, reducing the scope, and revising the objectives. Also, the automated 
work paper software, AutoAudit, includes a number of timeline steps to allow for 
monitoring of the issuance of the final report within 1 year. 


Recommendation 3 
We recommend that DOI OIG management: 1) ensure that audit reports are 
issued on a timely basis, as required by Government Auditing Standards and DOI 


OIG policies; and, 2) document factors that will delay the issuance of a timely 
report and request additional needs to meet the 1-year timeframe. 


Views of Responsible Office: Agree 
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SCOPE AND METHODOLOGY 
Scope and Methodology 


We tested compliance with the DOI OIG audit organization’s system of quality control to 
the extent we considered appropriate. These tests included a review of 10 of 33 audit and 
attestation reports issued during the period October 1, 2009, through September 30, 2010, 
and semiannual reporting periods ending March 31, 2010 and September 30, 2010. We 
also reviewed the internal quality control reviews performed by the DOI OIG. 


In addition, we reviewed the DOI OIG’s monitoring of engagements performed by IPAs 
where the IPA served as the principal auditor during the period October 1, 2009, through 
September 30, 2010. During the period, the DOI OIG contracted for the audit of its 
agency’s Fiscal Year 2008 and 2009 financial statements. 


We conducted our review at the DOI OIG headquarters office in Washington, DC and 
visited the Herndon, Virginia office. 


Reviewed Engagements Performed by the DOI OIG 


Report Number Report Date Report Title 


ER-IN-BIA-0014-2009 11/10/2009  OIG’s Independent Report on the “Office of 
National Drug Control Policy Performance 
Summary Report — BIA” 


Q-IN-OST-0001-2009 11/18/2009 Independent Auditors’ Report on the Tribal 
and Other Trust Fund Financial Statement 
Audit for Fiscal Year 2009 and Fiscal Year 
2008 


K-CX-NPS-0006-2009 11/24/2009 Westwind Contracting, Inc. Settlement 
Proposal for Termination for Convenience of 
the Government under Contract No. 
C5297080232, Hole in the Donut Remediation 
in Everglades, With the National Park Service 


C-IN-MOA-0010-2008 12/16/2009 DOT's Accountability and Preservation of 
Museum Collections 


Report Number 


R-GR-FWS-0002-2010 


C-IN-MMS-0007-2008 


R-GR-F WS-0003-2010 


ER-IN-OSS-0009-2009 


VI-EV-VIS-0003-2009 


Report Date 


02/18/2010 


05/25/2010 


07/09/2010 


07/21/2010 


09/08/2010 
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Report Title 


U.S. Fish and Wildlife Service Wildlife and 
Sport Fish Restoration Program Grants 
Awarded to the State of Massachusetts, 
Department of Fish and Game, Division of 
Fisheries and Wildlife 


Mineral Management Service: Royalty-in-Kind 
Program’s Oil Volume Verification Process 


U.S. Fish and Wildlife Service Wildlife and 
Sport Fish Restoration Program Grants 
Awarded to the State of Illinois, Department of 
Natural Resources 


Audit of the International Technical Assistance 
Program 


Monitoring of Capital Improvements Projects — 
Virgin Islands; Port Authority — Government 
of the Virgin Islands 


Reviewed Monitoring Files of the DOI OIG for Contracted Engagements 


Report Number 
X-IN-MOA-018-2009 


Report Date 
11/16/2009 


Report Title 


Independent Auditors’ Report on the Financial 
Statements for Fiscal Years 2009 and 2008 


Exhibit A 
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JUL 2 2 201 


Mr. Michael R. Esser 

Assistant Inspector General for Audits 
U.S. Office of Personnel Management 
1900 E St. NW 

Washington, DC 20415 


Re: Response to Draft Report on the System Review of the U.S. Department of the Interior 
Office of Inspector General 


Dear Mr. Esser: 


Thank you for the opportunity to comment on your draft report, presenting the results of 
your office’s External Peer Review of the U.S. Department of the Interior Office of Inspector 
General, Office of Audits, Inspections, and Evaluations. We are pleased that your office issued 
an opinion that our system of quality control for the year ended September 30, 2010 has been 
suitably designed and complied with to provide us with reasonable assurance of performing and 
reporting in conformity with applicable professional standards in all material aspects. We also 
appreciate the professionalism that was displayed by your team during the course of your review. 


We are committed to maintaining high quality audits and the peer review process allows 
us an excellent opportunity to assess and improve our performance. We agree with the conditions 
and recommendations presented in your draft report. A memorandum transmitting the results of 
your review will be issued and actions will be taken to address the areas of audit risk assessment, 
sampling methodology, and report timeliness. We plan to revise both our policies and quality 
assurance review process and will emphasize the conditions noted in your draft report. We plan 
on having the new policies issued and our new quality assurance process in place by September 
30, 2011. 


If you have any questions concerning this response, please call me at 202-208-5512. 
Sincerely, 


Kian We, E Omru 


Kimberly Elmore 
Assistant Inspector General 
for Audits, Inspections, and Evaluations 


Office of Audits, Inspections, and Evaluations | Washington, DC 


